CVEs published in January 2026
4,393 vulnerabilities, 438 critical, 16 exploited.
- thelibrarian the librarian, thelibrarian.io +1 moreCVE-2026-06157.3 High
- thelibrarian the librarian, thelibrarian.io +1 moreCVE-2026-06167.5 High
- thelibrarian the librarian, thelibrarian.io +1 moreCVE-2026-06137.5 High
- thelibrarian the librarian, thelibrarian.io +1 moreCVE-2026-06127.5 High
- bee interactive livewire filemanager, livewire-filemanager filemanager +1 moreCVE-2025-148949.8 Critical
- mattermost, mattermost server +1 moreApplication-Level DoS via infinite re-render loop in user profile handling6.8 Medium
hackage-serverHackageHackage package and doc upload stored XSS vulnerability9.9 Critical- apache airflowApache Airflow: proxy credentials for various providers might leak in task logs7.5 High
- hcl software myxalyticsImproper management of a static JWT signing secret in the web application, where the secret lacks rotation , introducing a security risk7.4 High
- apache airflowApache Airflow: Secrets in rendered templates could contain parts of sensitive values when truncated7.5 High
- liquidweb restrict content, stellarwp membership plugin – restrict content +1 moreMembership Plugin – Restrict Content <= 3.2.16 - Missing Authentication to Insecure Direct Object Reference and Sensitive Information Exposure8.2 High
- mattermost, mattermost server +1 moreDoS from quadratic complexity in model.ParseHashtags3.1 Low
- smci x13sem-fSupermicro BMC firmware update validation bypass8.4 High
- apache brpcApache bRPC: Remote command injection vulnerability in heap builtin service9.8 Critical
- stylemix cost calculator builderCost Calculator Builder <= 3.6.9 - Missing Authorization to Unauthenticated Payment Status Bypass5.3 Medium
- smci x12stw-fSupermicro BMC firmware update validation bypass7.2 High
- specialk user submitted posts – enable users to submit posts from the front endUser Submitted Posts <= 20260110 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'usp_access' Shortcode6.4 Medium
- wpdevteam essential addons for elementor – popular elementor templates & widgetsEssential Addons for Elementor <= 6.5.5 - Missing Authorization to Unauthenticated Sensitive Information Exposure5.3 Medium
- toa corporation multiple network cameras trifora 3 seriesPath Traversal vulnerability exists in multiple Network Cameras TRIFORA 3 series provided by TOA...7.1 High
- toa corporation multiple network cameras trifora 3 seriesCross-site scripting vulnerability exists in multiple Network Cameras TRIFORA 3 series provided...4.8 Medium
- toa corporation multiple network cameras trifora 3 seriesOS Command Injection vulnerability exists in multiple Network Cameras TRIFORA 3 series provided...8.7 High
- roxnor getgenie – ai content writer with keyword research & seo tracking toolsGetGenie – AI Content Writer with Keyword Research & SEO Tracking Tools <= 4.3.0 - Missing Authorization to Authenticated (Author+) Arbitrary Post Deletion4.3 Medium
- rebelcode rss aggregator – rss import, news feeds, feed to post, and autobloggingRSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging <= 5.0.10 - Reflected Cross-Site Scripting via className6.1 Medium
- smings leav last email address validatorLEAV Last Email Address Validator <= 1.7.1 - Cross-Site Request Forgery to Plugin Settings Update4.3 Medium
- torstenbulk dk pdf – wordpress pdf generatorDK PDF – WordPress PDF Generator <= 2.3.0 - Authenticated (Author+) Server-Side Request Forgery5.0 Medium
- linknacional rede itaú for woocommerce — payment pix, credit card and debitRede Itaú for WooCommerce — Payment PIX, Credit Card and Debit <= 5.1.5 - Missing Authorization to Unauthenticated Rede Order Logs Deletion5.3 Medium
- linknacional rede itaú for woocommerce — payment pix, credit card and debitRede Itaú for WooCommerce — Payment PIX, Credit Card and Debit <= 5.1.2 - Unauthenticated Order Status Manipulation5.3 Medium
- keesiemeijer related posts by taxonomyRelated Posts by Taxonomy <= 2.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'related_posts_by_tax' Shortcode6.4 Medium
- delta electronics diaviewDIAView - Command Injection Vulnerability7.8 High
- naver lucy-xss-filterlucy-xss-filter before commit e5826c0 allows an attacker to execute malicious JavaScript due to...6.1 Medium
- naver lucy-xss-filterlucy-xss-filter before commit 7c1de6d allows an attacker to induce server-side HEAD requests to...6.1 Medium
- plantumlPlantUML is vulnerable to Stored XSS due to insufficient sanitization of interactive attributes in GraphViz diagrams5.1 Medium
- smub all in one seo – powerful seo plugin to boost seo rankings & increase trafficAll in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic <= 4.9.2 - Missing Authorization to Authenticated (Contributor+) AI Access Token and Credit Disclosure4.3 Medium
- mailerlite – woocommerce integrationMailerLite - WooCommerce integration <= 3.1.3 - Missing Authorization to Data Deletion6.5 Medium
- paultgoodchild shield: blocks bots, protects users, and prevents security breachesShield Security <= 21.0.9 - Authenticated (Subscriber+) Insecure Direct Object Reference to Disable Google Authenticator4.3 Medium
- plugins360 all-in-one video galleryAll-in-One Video Gallery <= 4.5.7 - Authenticated (Author+) Arbitrary File Upload via VTT Upload Bypass8.8 High
- radykal fancy product designerFancy Product Designer | WooCommerce WordPress <= 6.4.8 - Unauthenticated Full Path Disclosure via 'pdf' Parameter5.3 Medium
- awesomesupport awesome support – wordpress helpdesk & support pluginAwesome Support – WordPress HelpDesk & Support Plugin <= 6.3.6 - Missing Authorization to Unauthenticated Role Demotion6.5 Medium
- brechtvds wp recipe makerWP Recipe Maker <= 10.2.2 - Insecure Direct Object Reference to Sensitive Information Exposure4.3 Medium
- wpdevelop booking calendarBooking Calendar <= 10.14.11 - Missing Authorization to Sensitive Information Exposure4.3 Medium
- gotac statistics database systemGotac｜Statistics Database System - Missing Authentication8.7 High
- gotac statistics database systemGotac｜Statistics Database System - Arbitrary File Read8.7 High
- delta electronics diaviewDIAView - Authentication Bypass Vulnerability9.8 Critical
- delta electronics diaviewDIAView - Authentication Bypass Vulnerability9.8 Critical
- aveva process optimizationAVEVA Process Optimization Cleartext Transmission of Sensitive Information7.6 High
- aveva process optimizationAVEVA Process Optimization Use of Potentially Dangerous Function8.5 High
- aveva process optimizationAVEVA Process Optimization Missing Authorization8.6 High
- aveva process optimizationAVEVA Process Optimization Uncontrolled Search Path Element9.3 Critical
- aveva process optimizationAVEVA Process Optimization SQL Injection9.3 Critical
- aveva process optimizationAVEVA Process Optimization Code Injection9.3 Critical
- Show moreLoading…